A candidate sees a question about a California business sharing customer lists with a marketing partner for a promotional event. No money changes hands. They confidently select "Not a sale, no monetary consideration," remembering the original CCPA definition. They fail the question, and possibly the exam, because they missed the crucial CPRA amendment: a "sale" now includes sharing for "monetary or other valuable consideration."
This single detail is where many candidates lose points on the State Privacy Laws domain. Success isn't about memorizing every state law. It's about knowing the specific distinctions the exam uses to set traps.
To pass the CIPP/US State Privacy Laws domain (CIPP5), you must master the key differences between the major state laws (CA, VA, CO, UT, CT) on topics like scope thresholds, consumer rights, and the definitions of "sale" and "sharing." Focus on comparative analysis, not rote memorization.
Key facts
- Exam Domain
- V. State Privacy Laws (CIPP5)
- Weight on Exam
- 22-24% (approx. 20-22 of 90 questions)
- Key Laws Tested
- CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), UCPA (Utah), CTDPA (Connecticut)
- Pass Rate
- The IAPP reports the overall CIPP/US pass rate is approximately 65%, with state law distinctions being a common weak area.
- Official Body
- International Association of Privacy Professionals (IAPP)
- Study Hours
- 15-25 hours for this domain, as part of a 60-100 hour total study plan.
What Does the State Privacy Laws Domain Actually Test?
The State Privacy Laws domain tests your knowledge of the U.S. state-level privacy legislation that has emerged in recent years. This section of the CIPP/US exam moves beyond federal laws like HIPAA or COPPA and focuses on the comprehensive privacy acts passed by individual states. It accounts for nearly a quarter of your score, making it a pivotal topic for most candidates.
Studying for CIPP/US? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
You are expected to know the core components of major state laws, especially the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The IAPP wants you to compare and contrast the obligations these laws place on businesses. This includes understanding their scope, the rights they grant to consumers, and the specific definitions for terms like "personal information," "sale," "sharing," and "consent."
This domain is a test of practical application.
The questions are designed to mimic real-world consulting scenarios where you must advise a business on its compliance obligations based on where it operates and whose data it processes. Try VoraPrep's free CIPP/US practice questions to see how these scenarios are structured.
How Are State Laws Tested on the CIPP/US Exam?
State Privacy Laws questions are integrated throughout the CIPP/US exam; it is not a separate section. You will face 90 multiple-choice questions in 150 minutes, with about 20-22 of those questions drawn directly from the Domain V blueprint.
There are two primary question formats you'll encounter:
- Direct Recall: These ask for a specific fact, like "Under the CTDPA, how many days does a controller have to respond to a consumer rights request?"
- Scenario-Based: These are more common and more difficult. They present a short story about a company and its data processing activities, then ask you to apply the law to the facts.
The scenario questions are where your judgment is truly tested. They require a two-step thought process: first, identify the relevant facts and determine which state's law applies. Second, apply the specific rule from that law to the scenario. Getting comfortable with this process is essential. For a complete overview of the test, see our full guide to the CIPP/US exam format and scoring.
Which State Law Topics Appear Most on the Exam?
Your study time for this domain should be focused on the areas that are most distinct and most likely to be tested. The IAPP Body of Knowledge is your guide, but here is where to concentrate your efforts.
The "Big Five" Comprehensive Privacy Laws
This is the heart of the domain. You must have a working knowledge of the five most frequently tested comprehensive privacy laws. The table below is a starting point, but building your own is the best way to learn.| Feature | CCPA/CPRA (California) | VCDPA (Virginia) | CPA (Colorado) | UCPA (Utah) | CTDPA (Connecticut) |
|---|---|---|---|---|---|
| Applicability | >$25M revenue; OR Processes 100k+ CA consumers/households; OR >50% revenue from selling/sharing CA data. | Processes 100k+ VA consumers; OR Processes 25k+ VA consumers & >50% gross revenue from data sales. | Processes 100k+ CO consumers; OR Processes 25k+ CO consumers & derives revenue/discount from data sales. | >$25M revenue & in UT; AND Processes 100k+ UT consumers OR Processes 25k+ UT consumers & >50% gross revenue from sales. | Processes 75k+ CT consumers; OR Processes 25k+ CT consumers & >25% gross revenue from data sales. |
| "Sale" Definition | Monetary or other valuable consideration. | Monetary consideration only. | Monetary or other valuable consideration. | Monetary consideration only. | Monetary or other valuable consideration. |
| Right to Correct | Yes | Yes | Yes | No | Yes |
| Rulemaking | Yes (CPPA) | No | Yes (AG) | No | No |
| Private Right of Action | Limited to data breaches. | No | No | No | No |
State Data Breach Notification Laws
Every state has one. The exam will not ask you to memorize all 50. Instead, it tests the common principles and key variations. Know the general definition of a breach, the concept of a "risk of harm" analysis, and the typical timelines for notifying affected individuals and attorneys general (e.g., "without unreasonable delay," or specific deadlines like 30, 45, or 60 days).Biometric and Health Information Privacy Laws
Be aware of specific state laws governing sensitive data types. The most famous is Illinois' Biometric Information Privacy Act (BIPA), known for its private right of action and significant statutory damages. You should also understand the general scope of state health privacy laws that exist outside of HIPAA.- Virginia (VCDPA): Does it apply? The threshold is processing data of 100k+ VA consumers OR 25k+ VA consumers and deriving >50% of gross revenue from data sales. GadgetGo processes 35,000 VA consumers. Let's assume its data sales constitute less than 50% of its $30M gross revenue. Based on these facts, the VCDPA does not apply.
- Colorado (CPA): Does it apply? The threshold is processing data of 100k+ CO consumers OR 25k+ CO consumers and deriving revenue from the sale of data. GadgetGo processes 40,000 CO consumers and sells data for revenue. The CPA does apply to GadgetGo's processing of Colorado residents' data.
This is exactly how the exam moves from memorization to judgment. VoraPrep's adaptive question bank includes over 1,400 CIPP/US questions, with hundreds of scenarios like this designed to train your analytical process.
Calculate Your CIPP/US Score & Study Hours by Domain
Adjust your practice scores across official CIPP/US blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
What's the Most Effective Way to Study for Domain V?
Given the volume of information, you need a strategy. Watching passive video lectures that just read statutes aloud is a recipe for low retention and exam-day panic. A more active, structured approach is necessary.
Step 1: Master the CCPA/CPRA Foundation
Start with California. It is the most comprehensive and influential state law, and many other states have based their legislation on it. Understand its core concepts deeply: who is a "consumer," what is "personal information," and the expanded definitions of "sale" and "sharing." Use VoraPrep's step-by-step interactive lessons to build this conceptual foundation without getting lost in the statutory text.Step 2: Build a Comparative Analysis Chart
This is the single most important study tool for Domain V. Create a spreadsheet or table like the one above, but build it yourself. For your first pass, just include columns for Applicability, Key Consumer Rights (including the right to opt-out of profiling), and Definitions for CA, VA, CO, UT, and CT. The act of researching and filling in this chart builds the mental model you need.Step 3: Drill with Scenario-Based Questions
You cannot pass this exam without extensive practice. Answering scenario-based questions forces you to apply your knowledge and reveals your blind spots. When you get a question wrong, don't just look at the right answer. Use the detailed explanations to understand why your choice was wrong and why the correct answer was better.Step 4: Solidify Rules with Spaced Repetition
For definitions, timelines, and key distinctions, use spaced-repetition flashcards. VoraPrep's FSRS flashcard system automatically schedules cards for you, showing you the material right before you're about to forget it. This is far more efficient for long-term retention than cramming. Dedicate 15 minutes each day to your flashcard review.What Are the Most Common Mistakes Candidates Make?
Hundreds of candidates have told us where they went wrong on Domain V. Learn from their experience.
- Trying to Memorize Everything: The volume is too high. You will burn out. Focus on the comparative framework. Know the major patterns (e.g., the "valuable consideration" states vs. the "monetary only" states) and the key exceptions.
- Ignoring "Minor" States: While California gets the most attention, the exam can and will ask questions about Utah, Connecticut, or breach notification laws. Have at least a high-level understanding of the key features of each law in the IAPP's Body of Knowledge.
- Confusing "Controller" and "Processor" Obligations: The exam loves to test the distinction. A processor's duties are typically defined by its contract with the controller. A controller has the primary responsibility for honoring consumer rights.
- Not Practicing Under Time Pressure: With only 100 seconds per question, you don't have time to look up rules in your mental library. Answering hundreds of CIPP/US State Privacy Laws practice questions builds the speed and pattern-recognition you need.
Which CIPP/US Study Resources Are Best for 2026?
Choosing the right study material is critical. Many candidates find themselves overwhelmed by expensive, outdated video courses or simple question banks with no real teaching component.
VoraPrep CIPP/US Course: We built VoraPrep to be the most efficient path to a pass for busy professionals. It is a complete, 6-pillar course designed for active learning, not passive viewing.- Textbook-Grade Lessons: Interactive lessons guide you through complex topics like state law comparisons with active recall checkpoints.
- Adaptive Practice Bank: Over 1,400 exam-calibrated questions adapt to your weak spots. If you struggle with CPA vs. VCDPA scope, our engine will give you more practice there.
- 1:1 Exam Simulators: Take full-length, timed mock exams that replicate the real IAPP testing experience.
- FSRS Spaced-Repetition Flashcards: Lock in key definitions and thresholds for the long term.
- Personalized Study Plan: Tell us your exam date, and we build a dynamic calendar to keep you on track.
- Vory, Your 24/7 Personal Tutor: Stuck on a question about the CPRA's "sharing" definition? Ask Vory for a step-by-step explanation, anytime.
Traditional prep courses often consist of overpriced ($1,500+) video-lecture bundles that require 100+ hours of passive watching. VoraPrep's interactive platform is built to help you learn 2-3x faster for a simple monthly subscription (starting at $25/month) with a 14-day free trial.